libarchive

Several local/remote vulnerabilities have been discovered in libarchive1,
a single library to read/write tar, cpio, pax, zip, iso9660 archives.
The Common Vulnerabilities and Exposures project identifies the following
problems:

• CVE-2007-3641
  It was discovered that libarchive1 would miscompute the length of a buffer
  resulting in a buffer overflow if yet another type of corruption occurred
  in a pax extension header.
• CVE-2007-3644
  It was discovered that if an archive prematurely ended within a pax
  extension header the libarchive1 library could enter an infinite loop.
• CVE-2007-3645
  If an archive prematurely ended within a tar header, immediately following
  a pax extension header, libarchive1 could dereference a NULL pointer.

The old stable distribution (sarge), does not contain this package.

For the stable distribution (etch), these problems have been fixed in
version 1.2.53-2etch1.

For the unstable distribution (sid), these problems have been fixed in
version 2.2.4-1.

We recommend that you upgrade your libarchive package.